Matrix DDoS Campaign Targets IoT Devices and Enterprise Servers to Build a Botnet

Nov 26, 2024 · Original article ↗

Summary

Aqua researchers detail Matrix’s campaign, which uses weak credentials, exposed services and known vulnerabilities to compromise IoT devices and servers, expand a DDoS botnet, and sell attack services through Telegram.

Key points

The campaign compromises internet-connected cameras, DVRs, routers, telecom equipment and servers through default or weak passwords, brute force, exposed credentials and vulnerability exploitation.
Researchers identified 10 CVEs in the campaign, including active exploitation of the critical Apache HugeGraph vulnerability CVE-2024-27348.
A worm-like script uses 167 discovered username-password pairs to find and compromise additional devices; 134 pairs were for root or admin accounts.
The operators use Mirai and other publicly available DDoS tools, alongside custom scripts and command-and-control infrastructure including Discord, Telegram and Playit.gg.
Targets include cloud-provider IP ranges, private clouds and companies, as well as IoT devices, with China and Japan prominent in the researchers’ target analysis.
A Telegram bot store offered paid DDoS plans; researchers also found limited cryptocurrency mining activity.
Aqua recommends changing default credentials, securing administrative protocols and applying firmware updates; its honeypots and sandbox analysis helped investigate the campaign.

Article Details

Attack Vectors: Brute-force login attempts using default or weak credentials against IoT devices and servers, including IP cameras, DVRs, routers, and telecom equipment.
Exploitation of vulnerabilities and misconfigurations in routers, surveillance devices, IoT equipment, Apache Hadoop YARN, and HugeGraph servers.
Scanning for exposed services including Telnet, SSH, Hadoop, and HugeGraph, then using compromised devices and servers to expand the botnet.
Scripts targeting exposed files containing passwords on HTTP servers; the credentials were loaded into a brute-force script deployed on an exposed server.
Deployment of botnet clients and DDoS tools, including Mirai and PYbot, to control compromised devices and launch attacks.
Use of a Discord bot to execute commands and launch UDP packet floods against specified IP addresses and ports.
Defensive Notes: Change default and weak credentials on internet-connected devices and servers.
Secure administrative protocols and services, including Telnet and SSH, and restrict access to exposed management interfaces.
Apply timely firmware and software updates to address known vulnerabilities.
Use sandbox analysis to examine Linux malware and scripts before execution; the article demonstrates this with Aqua Dynamic Threat Analysis.
Review downloads and other network activity during container runtime, including communications with GitHub, for potentially suspicious behavior.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`sponsored-ate[.]gl[.]at[.]ply[.]gg`	Listed as a C2 server.
IPV4	`199[.]232[.]46[.]132`	Listed as a C2 server.
IPV4	`217[.]18[.]63[.]132`	Listed as a download server.
IPV4	`5[.]181[.]159[.]78`	Listed as a download server.
IPV4	`5[.]42[.]78[.]100`	Listed as a C2 server.
IPV4	`78[.]138[.]130[.]114`	Listed as a C2 Discord server.
IPV4	`85[.]192[.]37[.]173`	Listed as a download server.
MD5	`0e3a1683369ab94dc7d9c02adbed9d89`	MD5 hash of the Discord DDoS botnet binary.
MD5	`53721f2db3eb5d84ecd0e5755533793a`	MD5 hash of a binary identified as trojan.siggen/casdet.
MD5	`5a66b6594cb5da4e5fcb703c7ee04083`	MD5 hash of a binary identified as trojan.sdjwg.
MD5	`76975e8eb775332ce6d6ca9ef30de3de`	MD5 hash of a DDoS Agent client identified in the campaign.
MD5	`866c52bc44c007685c49f5f7c51e05ca`	MD5 hash of a binary identified as trojan.gafgyt/mirai.
MD5	`9181d876e1fcd8eb8780d3a28b0197c9`	MD5 hash of a DDoS Agent Misp file identified in the campaign.
MD5	`9c9ea0b83a17a5f87a8fe3c1536aab2f`	MD5 hash of a binary identified as RiskWare/Win32.Kryptik.a.
MD5	`c332b75871551f3983a14be3bfe2fe79`	MD5 hash of a binary identified as miner.camelot/juiav.
MD5	`c7d7e861826a4fa7db2b92b27c36e5e2`	MD5 hash of the SSH scanner file named update.
MD5	`d653fa6f1050ac276d8ded0919c25a6f`	MD5 hash of a binary identified as trojan.gafgyt/mirai.
MD5	`df521f97af1591efff0be31a7fe8b925`	MD5 hash identified for Matrix's x86_64 Mirai malware.